diff options
| author | Kees Cook <keescook@chromium.org> | 2013-03-12 04:31:45 +0400 |
|---|---|---|
| committer | Daniel Vetter <daniel.vetter@ffwll.ch> | 2013-03-14 00:31:03 +0400 |
| commit | 3118a4f652c7b12c752f3222af0447008f9b2368 (patch) | |
| tree | 22bc815888c57441e75528c14bd1d57aa4abdc37 /net/lapb/lapb_timer.c | |
| parent | 2563a4524febe8f4a98e717e02436d1aaf672aa2 (diff) | |
| download | linux-3118a4f652c7b12c752f3222af0447008f9b2368.tar.xz | |
drm/i915: bounds check execbuffer relocation count
It is possible to wrap the counter used to allocate the buffer for
relocation copies. This could lead to heap writing overflows.
CVE-2013-0913
v3: collapse test, improve comment
v2: move check into validate_exec_list
Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Pinkie Pie
Cc: stable@vger.kernel.org
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Diffstat (limited to 'net/lapb/lapb_timer.c')
0 files changed, 0 insertions, 0 deletions